17 lines
777 B
Markdown
17 lines
777 B
Markdown
# CLEAN — gRPC (multi-language)
|
|
Scanned 2026-03-29 for CWE-407.
|
|
|
|
## Scope
|
|
|
|
- Java source: `examples/android/helloworld/` only (no Java RPC core in this clone)
|
|
- C++ core: `core/lib/`, `src/core/` — service resolution, call handling
|
|
|
|
## Findings
|
|
|
|
gRPC's Java implementation in this repository is limited to example code. The core RPC runtime is implemented in C++ and uses protobuf-generated descriptors with flat-array or hash-map lookups for service and method resolution. No quadratic list-membership pattern was found in:
|
|
|
|
- Method descriptor building (protobuf ServiceDescriptor uses array indexing)
|
|
- Service type resolution (registry uses hash map)
|
|
- Call filter/interceptor chains (fixed-size arrays assembled at startup)
|
|
|
|
**Result: No actionable CWE-407 defects.**
|